Pentest-Tools.com
AutomatedAI-enhanced offensive security platform for network, web app, API, and cloud vulnerability assessment with automated exploitation.
Pentest-Tools.com has 5 plans: a free plan, paid plans from $95/month and custom pricing for larger teams. We have not recorded a price change.
Pentest-Tools.com plans and prices
Free Edition
$0
- Attack surface mapping & recon tools — limited
- Subdomain & domain discovery — limited
- Virtual host discovery — limited
- URL fuzzing — limited
- Technology & WAF fingerprinting — limited
- Google hacking & indexed leaks — limited
- Network vulnerability scanning (detect 17,000+ CVEs) — limited
- DAST scanning (beyond OWASP Top 10) — limited
Show all 32 featuresShow fewer
- API scanning (REST, GraphQL) — limited
- CMS scanning (Wordpress, Drupal, Joomla, Sharepoint) — limited
- Cloud scanning (AWS, Azure, GCP vulnerabilities) — Not included
- Password auditing & bruteforcing — Not included
- Kubernetes container scanning — Not included
- Authenticated web app scans (incl. AI-assisted authentication) — Not included
- ML Classifier (AI false positive reduction) — Not included
- Flowmapper (hidden attack surface discovery for web apps) — Not included
- Internal network scanning (local networks and private clouds: AWS, Azure, etc.) — Not included
- Automatic CVE exploiter (Sniper) — Not included
- SQL Injection & XSS exploiters — Not included
- Handlers (cookies, keystrokes, HTML content, source IPs, etc.) — Not included
- Proof-of-exploitation capture — Not included
- Scanned assets per scan cycle — Up to 5
- Parallel scans — 2
- Queued scans — Up to 100
- Scheduled scans — 25
- Scan results exports (PDF, HTML, CSV, XLSX) — Included
- Aggregated exports from multiple scans — Included
- Exportable attack surface map (CSV, JSON) — Included
- API access — Not included
- Webhook alerts — Not included
- Team management & sharing: Workspaces — 1
- Historical data storage period — 90 days
NetSec
monthly$95/mo
- yearly$948/yr($79/mo billed yearly (save 2 months))
- Attack surface mapping & recon tools — Included
- Open ports & services discovery — Included
- Subdomain & domain discovery — Included
- Virtual host discovery — Included
- URL fuzzing — Included
- Technology & WAF fingerprinting — Included
- Google hacking & indexed leaks — Included
- Network vulnerability scanning (detect 17,000+ CVEs) — Included
Show all 32 featuresShow fewer
- DAST scanning (beyond OWASP Top 10) — limited
- API scanning (REST, GraphQL) — limited
- CMS scanning (Wordpress, Drupal, Joomla, Sharepoint) — limited
- Cloud scanning (AWS, Azure, GCP vulnerabilities) — Included
- Password auditing & bruteforcing — Included
- Kubernetes container scanning — Included
- Authenticated web app scans (incl. AI-assisted authentication) — Not included
- ML Classifier (AI false positive reduction) — Not included
- Flowmapper (hidden attack surface discovery for web apps) — Not included
- Internal network scanning (local networks and private clouds: AWS, Azure, etc.) — Optional add-on
- Automatic CVE exploiter (Sniper) — Not included
- SQL Injection & XSS exploiters — Not included
- Handlers (cookies, keystrokes, HTML content, source IPs, etc.) — Not included
- Proof-of-exploitation capture — Not included
- Scanned assets per scan cycle — 5-500+
- Parallel scans — Based on assets quota
- Queued scans — Based on assets quota
- Scheduled scans — Based on assets quota
- Scan results exports (PDF, HTML, CSV, XLSX) — Included
- Aggregated exports from multiple scans — Included
- Exportable attack surface map (CSV, JSON) — Included
- API access — Included
- Webhook alerts — Included
- Team management & sharing: Workspaces — Unlimited
WebNetSec
monthly$140/mo
- yearly$1,392/yr($116/mo billed yearly (save 2 months))
- Attack surface mapping & recon tools — Included
- Open ports & services discovery — Included
- Subdomain & domain discovery — Included
- Virtual host discovery — Included
- URL fuzzing — Included
- Technology & WAF fingerprinting — Included
- Google hacking & indexed leaks — Included
- Network vulnerability scanning (detect 17,000+ CVEs) — Included
Show all 32 featuresShow fewer
- DAST scanning (beyond OWASP Top 10) — Included
- API scanning (REST, GraphQL) — Included
- CMS scanning (Wordpress, Drupal, Joomla, Sharepoint) — Included
- Cloud scanning (AWS, Azure, GCP vulnerabilities) — Included
- Password auditing & bruteforcing — Included
- Kubernetes container scanning — Included
- Authenticated web app scans (incl. AI-assisted authentication) — Included
- ML Classifier (AI false positive reduction) — Included
- Flowmapper (hidden attack surface discovery for web apps) — Included
- Internal network scanning (local networks and private clouds: AWS, Azure, etc.) — Optional add-on
- Automatic CVE exploiter (Sniper) — Not included
- SQL Injection & XSS exploiters — Not included
- Handlers (cookies, keystrokes, HTML content, source IPs, etc.) — Not included
- Proof-of-exploitation capture — Not included
- Scanned assets per scan cycle — 5-500+
- Parallel scans — Based on assets quota
- Queued scans — Based on assets quota
- Scheduled scans — Based on assets quota
- Scan results exports (PDF, HTML, CSV, XLSX) — Included
- Aggregated exports from multiple scans — Included
- Exportable attack surface map (CSV, JSON) — Included
- API access — Included
- Webhook alerts — Included
- Team management & sharing: Workspaces — Unlimited
Pentest Suite
monthly$190/mo
- yearly$1,896/yr($158/mo billed yearly (save 2 months))
- Attack surface mapping & recon tools — Included
- Open ports & services discovery — Included
- Subdomain & domain discovery — Included
- Virtual host discovery — Included
- URL fuzzing — Included
- Technology & WAF fingerprinting — Included
- Google hacking & indexed leaks — Included
- Network vulnerability scanning (detect 17,000+ CVEs) — Included
Show all 32 featuresShow fewer
- DAST scanning (beyond OWASP Top 10) — Included
- API scanning (REST, GraphQL) — Included
- CMS scanning (Wordpress, Drupal, Joomla, Sharepoint) — Included
- Cloud scanning (AWS, Azure, GCP vulnerabilities) — Included
- Password auditing & bruteforcing — Included
- Kubernetes container scanning — Included
- Authenticated web app scans (incl. AI-assisted authentication) — Included
- ML Classifier (AI false positive reduction) — Included
- Flowmapper (hidden attack surface discovery for web apps) — Included
- Internal network scanning (local networks and private clouds: AWS, Azure, etc.) — Optional add-on
- Automatic CVE exploiter (Sniper) — Included
- SQL Injection & XSS exploiters — Included
- Handlers (cookies, keystrokes, HTML content, source IPs, etc.) — Included
- Proof-of-exploitation capture — Included
- Scanned assets per scan cycle — 5-500+
- Parallel scans — Based on assets quota
- Queued scans — Based on assets quota
- Scheduled scans — Based on assets quota
- Scan results exports (PDF, HTML, CSV, XLSX) — Included
- Aggregated exports from multiple scans — Included
- Exportable attack surface map (CSV, JSON) — Included
- API access — Included
- Webhook alerts — Included
- Team management & sharing: Workspaces — Unlimited
Custom / Enterprise
Custom
- Attack surface mapping & recon tools — Included
- Open ports & services discovery — Included
- Subdomain & domain discovery — Included
- Virtual host discovery — Included
- URL fuzzing — Included
- Technology & WAF fingerprinting — Included
- Google hacking & indexed leaks — Included
- Network vulnerability scanning (detect 17,000+ CVEs) — Included
Show all 32 featuresShow fewer
- DAST scanning (beyond OWASP Top 10) — Included
- API scanning (REST, GraphQL) — Included
- CMS scanning (Wordpress, Drupal, Joomla, Sharepoint) — Included
- Cloud scanning (AWS, Azure, GCP vulnerabilities) — Included
- Password auditing & bruteforcing — Included
- Kubernetes container scanning — Included
- Authenticated web app scans (incl. AI-assisted authentication) — Included
- ML Classifier (AI false positive reduction) — Included
- Flowmapper (hidden attack surface discovery for web apps) — Included
- Internal network scanning (local networks and private clouds: AWS, Azure, etc.) — Optional add-on
- Automatic CVE exploiter (Sniper) — Included
- SQL Injection & XSS exploiters — Included
- Handlers (cookies, keystrokes, HTML content, source IPs, etc.) — Included
- Proof-of-exploitation capture — Included
- Scanned assets per scan cycle — 5-500+
- Parallel scans — Based on assets quota
- Queued scans — Based on assets quota
- Scheduled scans — Based on assets quota
- Scan results exports (PDF, HTML, CSV, XLSX) — Included
- Aggregated exports from multiple scans — Included
- Exportable attack surface map (CSV, JSON) — Included
- API access — Included
- Webhook alerts — Included
- Team management & sharing: Workspaces — Unlimited
Price history
Last 0 recorded changes
No price changes recorded yet.
Other Security products
No confirmed alternatives yet.